"decrypt in place"              "move buffer ref."
+------------------+ "(no copy)"    +--------------+ "(no copy)"     +--------------+
| "receive buffer" +--=------------>| "plain text" +--=------------->| "disk cache" |
+------------------+                | "buffer"     |                 +------+-------+
        ^                           +--------------+                        |
        | "read() on socket"                              "write() to file" |
        | "(copy)"                                        "(copy)"          |
---=----|---------------------------------=---------------------------------|--=----
        |                       "kernel space"                              |
        |                                                                   v
+-------+---------+                                           +---------------------+
| "socket kernel" |                                           | "kernel page cache" |
| "buffer"        |                                           |                     |
+-----------------+                                           +---------------------+